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Iteaut  of  the  short  tint*  allowed  to  present  this  topic,  I  cannot  ponotratc  to  the 
depth  required  to  cover  such  a  comprehensive  sub|ect.  I  hope  I  can  stimulate 
enough  Interest  for  further  discussion  In  our  question/answer  period. 

The  design,  development,  test  and  deployment  of  military  weapon  systems  are 

usually  cesoelated  with  the  use  of  hazardous  materials.  Chemical  or  nuclear  energy  * 

sources  to  produce  heat  and  overpressure  effects  are  the  most  used.  The  paramount 

objective  of  the  US  Air  force  Nuclear  Safety  Program  Is  the  prevention  of  oceldentlal  1 

or  premature  occurrence  of  a  nuclear  detonation.  Confidence  that  the  events  necessary 

to  produce  a  nuclear  yield,  arm  or  fire  a  warhead,  or  release  or  launch  a  vehicle  . 

will  not  occur  except  when  authorised.  These  same  objectives  generally  apply  to 

any  weapon  or  hazard  source.  Since  a  nuclear  weapon  s  us  poses  cataclysmic 

consequences  In  the  event  of  a  catas trophy,  a  systems  approach  with  total  Involve- 

ment  of  people,  hardware,  software,  policy,  concepts,  etc.,  Is  necessary  to  assure 

a  low  level  of  risk. 

The  purpose  of  this  presentation  Is  to  relate  the  concepts  and  methodology  of  System 
Safety  to  the  reduction  of  explosives  hazarcb.  We  can  best  fulfill  this  purpose  by  an 
example  and  examine  some  of  the  results  of  an  Integrated  system  safety  program  for 
a  modern  sophisticated  weapon  system  called  SRAM. 

SRAM  Is  the  acronym  for  the  Short  Range  Attack  Missile  capable  of  air  launch  from 

the  B-52  and  FB-1 1 1A  aircraft.  We  also  call  It  AGM-69A  (Air  to  Ground  Missile) 

or  Weapon  System  140A  (Chart  I) .  When  we  refer  to  the  Weapon  System  we  Include 

the  aircraft  and  special  “black  box"  equipment,  the  missile,  people.  Aerospace  fe 

Ground  Equipment  (AGE),  Technical  Orders,  Training  Equipment.  All  the  hardware, 

software,  people  and  the  systems  necessary  for  acquisition.  4 

The  system  features  (Chart  2)  Indicate  the  Interrelated  aspects  of  missile  safety, 
nuclear  safety,  range  safety,  ground  safety,  explosives  safety,  flight  safety  and 
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Industrial  safety  art  encompassed  In  this  weapon  system.  The  missile  (Chart  3) 

Is  prooelled  by  a  spilt  pulse  type  of  booster/cruise  Class  II  solid  propellant  motor. 

An  Iner  .l/solld  state  eomputeflzed  guidance  system  steers  the  missile,  which 
It  an  aerodynamic  shape,  with  moveable  fins.  Various  ordnance  Initiated  subsystems 
are  used  for  ejection  from  the  aircraft,  battery  activation,  controls  power  boost 
activation  and  fins  unlock  devices .  A  linear  shaped  charge  (LSC)  Is  used  on  the  missile 
motor  for  test  launches  to  render  the  motor  non-pro pulslve  and  meet  range  safety 
requirements. 

Chart  4  is  a  paraphrased  extract  from  the  contract  statement  of  work  which  requires  . 
systematic  analyses  and  a  mathematical  model  for  probability  prediction  and  assessment 
of  numerical  safety  requirements.  Chart  Ska  summary  of  the  applicable  specifications, 
manuals  and  regulations  that  specify  qualitative  design  and  operating  safety  requirements. 
One  of  particular  Interest  Is  the  application  of  MIL-STD-833,  to  minimize  the  hazards 
of  Electro  Magnetic  Interference  (EMI).  All  the  SRAM  squibs  and  Ignition  devices  are 
designed  to  meet  this  standard  to  minimize  premature  or  Inadvertent  Ignition.  I 
assume  most  of  you  are  familial  enough,  generally,  with  these  requirements  without 
dwelling  on  them.  Charts  6  and  7  show  the  requirements  to  meet  federal,  state  and 
local  codes  and  Insure  protection  of  employees  and  property  during  manufacture 
and  transport  of  explosive  components. 

The  application  of  System  Safety  Engineering  (Chart  8)  consists  oft  analysis  for 
Identification  of  hazards  by  gross,  subsystem  and  system  analyses;  categorization  of  the 
hazard  as  to  degree  of  severity;  necessary  correction  of  the  system  to  eliminate  or 
reduce  the  hazard.  Preliminary  and  Critical  Design  Reviews  (PDR,  CDR)  are  key 
correction  points.  Once  hardware  Is  built,  the  Engineering  Change  Proposal  (ECP) 
implements  changes.  The  system  analyses  culminate  into  inputs  for  the  system  math  model, 
our  major  tool  for  assessing  the  degree  of  achievement  of  our  numerical  safety  goals . 

(  Chart  9).  The  system  safety  numerical  requirements  (Chart  10)  are  allocated  by  phases 
which  are  further  allocated  Into  the  mission  cycle  (Chart  II). 
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The  logic  model,  for  the  numerical  allocation  and  assessment  program,  met  tho  Fault 
Troo  technique.  Chart  12 shows  the  top  system  tree  for  the  FI-1 1 1  and  1-52  Emergency 
War  Order  (EWO)  or  Operational  Test  Launch  (OTL)  critical  or  catastrophic  events. 

The  hazardous  events  Identified  in  the  system  (Chart  13)  are  Identified  by  hazard 
analyses  of  the  system.  Probabilities  for  these  events  are  allocated  by  phase 
and  on  assessment/prediction  made  by  a  computer  simulation  of  over  o  million  trials 
of  the  system  model  through  Its  mission  cycle.  Data  sources  (Chart  U)  draw  from 
reliability,  biotechnology  and  maintainability  estimates  for  the  system.  The 
failure  rates  are  Inductively  summed  by  Boolean  to  give  the  probability  for  the  top 
ovents.  The  Monte  Carlo  technique  Is  used  to  simulate  the  system  model  and  derive  the 
probabilities  by  phases. 

An  example  of  haw  the  system  fault  tree/computer  simulation  technique  eon  be  used  to  predict 
explosive  hazards,  and  evaluate  the  need  for  change  to  reduee  the  hazards  and  the  effects, 

I  would  like  to  discuss  some  of  the  analyses  leading  to  the  first  live  launch  of  a  SRAM 
from  the  B-52.  Chart  15  shows  the  ma|or  hazardous  events  that  could  occur  during  tho 
launch.  The  hazard  of  most  concern  was  a  missile  motor  explor'  m  prior  to  or  after 
launch.  Premature  activation  of  the  command  dostruct  linear  shaped  charges  could 
cause  Ignition  of  the  propellant  with  case  rupture  and  dispersal  of  motor  ease  fragments. 

The  events  that  could  cause  this  are  shown  In  Chart  !6. 

The  other  major  event  was  a  missile  motor  explosion  caused  by  the  events  shown  In 
Chart  17,  which  are  In  addition  to  failures  In  the  motor  mechanical  components.  Chart  18 
shows  the  prediction  for  the  first  launch  using  a  1.5  second  Ignition  time  after  release 
for  the  boost  pulse.  A  probability  of  1 .44  x  10~4  was  predicted  for  mtsslle/carrler  collision 
caused  by  fragments  from  a  motor  case  rupture  due  to  overpressurization  striking  the  aircraft 
and  causing  critical  damage.  The  relatively  law  probabilities  for  command  dostruct  and 
promo  hire  Ignition  fay  the  motor  Ignition  circuitry  Indicated  they  were  sufficiently  safe. 

The  most  significant  contribution  to  the  event  were  physical  failures  In  the  motor.  A 
secondary  parametric  study  was  made  of  the  probability  of  motor  case  overpressurization 
(explosion)  and  the  probability  of  fragments  striking  tho  aircraft  and  causing  serious  damage. 


Ctath  19  and  20  show  the  logic  of  event*  and  probabilities  for  the  motor  explosion, 

I .  1  x  I0~3,  which  Indicated  a  need  to  Increase  the  separation  time  between  the 
missile  and  aircraft  since  at  1 .5  seconds  Ignition  time  the  missile  was  only  about  25 

to  40  feet  away  from  the  aircraft.  Using  the  model  of  Chart  21,  whleh  assumes  the  motor 
fragments  In  a  subtended  cone  strike  the  aircraft,  with  the  penetration  criteria  of 
Chart  22,  and  empirical  data  from  motor  firings  which  overpressurized  and  produced 
fragments,  the  graph  on  Chart  23  was  derived  from  maximum  penetration  heights 
for  critical  wing  panels  on  the  aircraft.  The  Chart  24  was  developed  for  the  probability 
of  fragments  striking  the  aircraft  at  various  separation  distances.  Using  a  2000  foot 
separation  distance  (mcmlmum  fragment  distance  from  motor  firing  data)  a  conservative 

II. 5  second  delay  was  used  for  Ignition  time  of  the  motor  boost  pulse.  The  predicted 
probability  of  1  x  10“^®  for  one  of  50  particles  striking  the  aircraft  gave  an  Increase 
of  same  20  orders  of  magnitude.  A  motor  Improvement  program  has  been  started 

to  eliminate  the  cause  of  failure  predicted  by  the  analysts.  As  more  empirical  motor 
firing  data  are  generated  to  Indicate  higher  confidence  with  lower  risk,  the  firing 
time  for  the  motor  will  be  reduced  to  the  normal  1.5  seconds.  Chart  25  b  a  summary 
of  air  launched  missile  Incidents,  Including  operational  and  development  launches. 

It  Is  Interesting  to  note  that  these  empirical  data  correlates  with  the  current  predictions 
for  SRAM. 

This  briefly  describes  the  degree  of  Involvement  required  for  a  system  safety  analysis 
and  how  the  hazards  associated  with  the  use  of  explosives  can  be  effectively  reduced. 
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THE  SAFETY  ASPECTS  OP  THE  INERT-DILUENT  PROCESS 
AS  APPLIED  TO  PROPELLANTS  PROCESSING 


Larry  D.  Mender aon 

U.S.  Naval  Ordnance  Station,  Indian  Head,  Md. 

The  Naval  Ordnance  Station  la  actively  Investigating 
continuous  processing  techniques  usable  for  rocket  propellants. 
One  of  these  techniques,  the  Inert- Diluent  process  has  been, 
under  study  for  the  past  nine  years.  This  process  Is  based 
on  the  Qulckmlx  process  patented  by  Rocketdyne  Division  of 
North  American  Rockwell.  This  process  has  the  advantage 
that  all  of  the  propellant  Ingredients  Investigated  are 
desensitised  when  held  In  emulsion  or  suspension  In  the 
heptane  carrier,  in  the  line  sites  Encountered  In  the  process, 
and  at  concentration  greater  than  /those  used  in  the  process. 

The  results  of  early  safety  tests  have  shown  that,  by 
separation  of  the  various  processing  areas,  no  chance  existed 
for  transmittal  of  an  explosion  from  one  processing  area  to 
another  by  means  of  the  process.  Since  small  quantities  of 
material  are  In  process  at  any  Instant,  the  chance  of  having 
an  incident  of  large  magnitude  (such  as  have  occurred  in 
large  batches  of  explosives)  Is  greatly  reduced. 

The  Naval  Ordnance  Station  currently  has  two  Inert  Diluent 
facilities.  A  pilot  plant,  which  has  the  capacity  for 
one  thousand  pounds  per  hour  or  less  and  where  quantities  of 
up  to  five  thousand  pounds  may  be  processed,  and  a  larger 
facility  where  a  maximum  rate  of  twenty- five  hundred  pounds 
per  hour  may  be  produced  In  quantities  of  thirty  thousand 
pounds.  Both  facilities  use  similar  equipment,  but  the 
larger  facility  has  considerably  more  sophisticated  equipment 
and  buildings. 

Of  particular  interest  within  the  Inert  Diluent  Process 
are  remotely  controlled  solids  handling  systems  and  casting 
systems . 

The  solid  feeder,  developed  for  this  process,  does  not 
use  the  conventional  belts  or  screw  conveyors,  normally 
associated  with  continuous  solid  feeders.  Instead  the 
foeder  uses  a  weighing  mechanism  which  greatly  reduces  the 
friction  imposed  upon  the  solids.  A  small  weighing  hopper, 
which  holds  less  than  one  pound  of  typical  explosive  solid 
ingredients,  has  been  fitted  with  a  bottom  discharge  valve. 


FOR  OFFICIAL  USE  ONLY 


31 


FOR  OFFICIAL  USE  ONLY 


This  valve  is  similar  in  form  to  tha  commarcially  available 
Rad  Jacket  Valve  but  is  constructed  of  fifty  thousandths 
(0.050")  thick  rubber  tubing  enclosed  in  a  light  gage  metal 
housing.  When  the  annular  space  between  the  metal  housing 
and  the  rubber  tubing  is  pressurized  (with  between  three  and 
four  pounds  per  square  inch  gage  air),  the  rubber  tube 
gently  reduces  in  diameter,  folds,  and  closes  off  the 
discharge  orifice  of  the  hopper.  This  sphincter- like  action 
gently  shuts  off  flow  from  the  weigh  hopper. 

In  both  IDP  facilities  the  solids  from  manually  loaded 
hoppers  flow  through  the  special  solid  feeders  to  a  pump 
agitated  sollds/carrier  dispersion  vessel.  The  solids  are 
then  transported  as  slurries  in  heptane  to  the  mixing  point 
where  they  are  mixed  with  the  carrier  emulsified  explosive 
plasticizer.  The  carrier  is  decanted  in  a  stilling  vessel 
awhile  the  explosive  mix  is  either  degassed  into  a  casting 
pot  or  directly  into  a  rocket  motor  or  other  casting  configu¬ 
ration  at  10  mm  Hg  absolute  pressure. 

In  the  pilot  plant  the  explosive  flows  through  hoses 
into  two  alternately  filled,  evacuated,  casting  pots.  As 
the  explosive  enters  the  casting  pot  it  is  degassed  by  passing 
through  a  slit  plate.  When  a  casting  pot  is  full,  as  observed 
by  closed  circuit  television  on  a  dial  type  weight  indicator, 
by  addition  of  controlled  nitrogen  the  remaining  free  volume 
is  slowly  brought  to  a  pressure  sufficient  to  transfer  the 
explosive  through  a  casting  manifold  into  rocket  motors  which 
have  previously  been  placed  on  hand  carts.  After  the  IDP 
process  has  been  shut  down,  these  carts  are  manually  moved  to 
separate  curing  facilities. 

Control  of  the  casting  is  done  via  remotely  controlled 
Saunders  valves  and  Red  Jacket  valves,  with  the  aid  of 
closed  circuit  television. 

In  the  larger  IDP  facility  the  explosive  material  flows 
through  the  separator,  transfer  hose,  and  slit  degassing 
device,  directly  into  a  rocket  motor  positioned  in  an  evacuated 
casting  vessel.  This  casting  vessel  is  a  stainless  steel  clad 
pit  fifteen  feet  in  diameter  by  thirty  feet  deep  with  vacuum 
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capability.  A  series  of  several  caatinga  may  be  positioned 
on  a  turntable  system  which  is  utilized  to  position  the 
motors  directly  beneath  the  slit  degassing  device.  Operation 
of  the  system  is  so  interlocked  as  to  avoid  underfill  or 
overfill.  Rotation  of  the  turntable  is  interlocked  to  the 
casting  system  so  that  explosive  may  only  flow  into  an  empty 
or  filling  rocket  motor ,  never  into  a  full  unit.  Explosive 
drips  are  caught  on  either  Teflon* lined  trays  or  on  electri¬ 
cally  conductive  plastic  sheets.  The  casting  operation  is 
easily  observed  over  a  closed- circuit  television  system. 
Operator  override  is  possible  on  the  system,  but  only  to  shut 
off  the  flow  of  explosive  or  stop  rotation  of  the  turntable. 
Capacitance  or  float  type  level  switches  are  used  to  shut  off 
explosive  flow  into  the  rocket  motor  when  it  is  full.  After 
casting,  the  vacuum  on  the  casting  vessel  is  slowly  released 
with  nitrogen  and  curing  remotely  programmed  for  the  cast-in- 
place  rocket  motors.  After  curing,  the  lid  to  the  casting  pit 
is  removed  and  the  motors  are  transferred  for  final  inspection, 
assembly,  and  shipment.  The  scrap  explosive  is  easily  peeled 
from  the  hardware  after  it  is  cured.  At  the  end  of  a  run  all 
explosive  transfer  hoses  are  washed  with  heptane  into  a  scrap 
vessel  located  in  the  casting  pit. 

In  both  facilities  no  personnel  are  exposed  to  explosives 
during  mechanical  handling  of  the  material.  In  all  cases 
all  of  the  operators  remain  in  concrete  blockhouses  several 
hundred  feet  from  the  casting  process  so  that  exposure  to 
uncured  material  is  minimized  or  eliminated. 
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Comments : 


Discussion  and  comments  on  IDP  centered  around  technical 
aspects  of  the  process  rather  than  the  safety  aspects.  These 
included: 

a.  A  discussion  on  the  moisture  removal  qualities  of 
carrier  liquid  during  processing  and  the  capability  of 
removing  the  carrier  from  the  matrix  to  below  the  detectable 
range  prior  to  cure  of  the  cast  material.  Formulations 
processed  in  the  50,000  to  100,000  cp  viscosity  range  that 
were  vacuum  cast  and  deaerated,  gave  essentially  voidless 
castings.  The  process  is  particularly  well  suited  to  double¬ 
base  formulations  in  this  viscosity  range. 

b.  A  discussion  on  the  suitability  of  IDP  for  other 
formulations  revealed  that  composite  and  cross-linked  formu¬ 
lations  were  not  well  suited.  A  Rocketdyne  representative 
declared  that  they  were  looking  at  the  suitability  of  the 
system  to  process  Tritonol  and  H-6  using  water  as  a  carrier. 
Comments  from  others  questioned  the  removal  of  water  (below 

2%  level)  from  TNT  but  agreed  that  it  may  be  a  safer  operation 
in  that  it  would  reduce  the  number  of  people  normally  exposed 
to  the  melt  and  load  operation. 

c.  Other  comments  were  on  the  wisdom  of  applying  continuous 
and  remote  processes  and  technology  of  this  type  to  explosive 
fill  operations.  The  consensus  was  that  it  would  be  a  good 
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MEMORANDUM  FOR  DDESB  RECORDS 


0  7  JUL  2000 


SUBJECT:  Declassification  of  Explosives  Safety  Seminar  Minutes 

References:  (a)  Department  of  Defense  5200. 1-R  Information  Security  Program,  14  Jan  1997 
(b)  Executive  Order  12958,  14  October  1995  Classified  National  Security 

Information 


In  accordance  with  reference  (a)  and  (b)  downgrading  of  information  to  a  lower  level  of 
classification  is  appropriate  when  the  information  no  longer  requires  protection  at  the  originally 
level,  therefore  the  following  DoD  Explosives  Safety  Seminar  minutes  are  declassified: 

a.  AD#335188  Minutes  from  Seminar  held  10-11  June  1959. 

b.  AD#332709  Minutes  from  Seminar  held  12-14  July  1960. 

c.  AD#332711  Minutes  from  Seminar  held  8-10  August  1961. 

d.  AD#332710  Minutes  from  Seminar  held  7-9  August  1962. 

e.  AD#346196  Minutes  from  Seminar  held  20-22  August  1963. 

f.  AD#456999  Minutes  from  Seminar  held  18-20  August  1964. 

g.  AD#368108  Minutes  from  Seminar  held  24-26  August  1965. 

h.  AD#801 103  Minutes  from  Seminar  held  9-1 1  August  1966. 

i.  AD#824044  Minutes  from  Seminar  held  15-17  August  1967. 

j.  AD#846612  and  AD#394775  Minutes  from  Seminar  held  13-15  August  1968. 

k.  AD#862868  and  AD#861893  Minutes  from  Seminar  held  9-10  September 
1969. 


The  DoD  Explosives  Safety  Seminar  minute; 
release,  distribution  unlimited. 


,e  considered  to  be  public 


DANIEL  T.  TOMPKINS 


Colonel,  USAF 
Chairman 
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